← All changes | src/model/setting/class-session-protection.php +55 -5 5.3.1 → 6.3.0 View file →

		@@ -17,8 +17,13 @@
17	17	class Session_Protection extends Setting {
18	18	use User;
19	19
20	20	/**
	21	+ * Maximum allowed idle timeout in hours (~24.8 days, aligned with JS setTimeout 32-bit limit).
	22	+ */
	23	+ public const MAX_IDLE_TIMEOUT_HOURS = 596;
	24	+
	25	+ /**
21	26	* Feature status
22	27	*
23	28	* @defender_property
24	29	* @var bool
		@@ -76,22 +81,45 @@
76	81	*
77	82	* @return void
78	83	*/
79	84	protected function before_load(): void {
80		- $tweak_duration = wd_di()->get( Login_Duration::class )->get_tweak_duration();
81		- $this->login_duration = ! empty( $tweak_duration )
82		- ? $tweak_duration
83		- : $this->login_duration;
	85	+ $this->login_duration = $this->get_default_duration();
84	86	$this->user_roles = array( 'administrator' );
85	87	}
86	88
87	89	/**
	90	+ * Clamps idle_timeout to MAX_IDLE_TIMEOUT_HOURS to guard against legacy values saved without a limit.
	91	+ *
	92	+ * @return void
	93	+ */
	94	+ protected function after_load(): void {
	95	+ if ( $this->idle_timeout > self::MAX_IDLE_TIMEOUT_HOURS ) {
	96	+ $this->idle_timeout = self::MAX_IDLE_TIMEOUT_HOURS;
	97	+ }
	98	+ }
	99	+
	100	+ /**
	101	+ * Validates that idle_timeout does not exceed the allowed maximum.
	102	+ *
	103	+ * @return void
	104	+ */
	105	+ protected function after_validate(): void {
	106	+ if ( $this->idle_timeout > self::MAX_IDLE_TIMEOUT_HOURS ) {
	107	+ $this->errors['idle_timeout'] = sprintf(
	108	+ /* translators: %d: maximum allowed hours */
	109	+ esc_html__( 'Idle timeout cannot exceed %d hours (30 days).', 'defender-security' ),
	110	+ self::MAX_IDLE_TIMEOUT_HOURS
	111	+ );
	112	+ }
	113	+ }
	114	+
	115	+ /**
88	116	* Has lock properties?
89	117	*
90	118	* @return bool
91	119	*/
92	120	public function has_properties(): bool {
93		- return ! empty( $this->lock_properties );
	121	+ return array() !== $this->lock_properties;
94	122	}
95	123
96	124	/**
97	125	* Is property locked?
		@@ -110,6 +138,28 @@
110	138	* @return string
111	139	*/
112	140	public static function get_module_slug(): string {
113	141	return 'session-protection';
	142	+ }
	143	+
	144	+ /**
	145	+ * Determines whether session protection is currently active.
	146	+ *
	147	+ * @return bool True if enabled and roles are set; otherwise, false.
	148	+ */
	149	+ public function is_active(): bool {
	150	+ return $this->enabled && count( $this->user_roles ) > 0;
	151	+ }
	152	+
	153	+ /**
	154	+ * Retrieves the default login duration.
	155	+ *
	156	+ * @return int Default login duration in days.
	157	+ */
	158	+ public function get_default_duration(): int {
	159	+ $tweak_duration = wd_di()->get( Login_Duration::class )->get_tweak_duration();
	160	+
	161	+ return $tweak_duration > 0
	162	+ ? $tweak_duration
	163	+ : $this->login_duration;
114	164	}
115	165	}